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It is now 6 weeks since Chinese health authori- 
ties announced the discovery of a novel coronavirus 
(2019-nCoV) [1] causing a cluster of pneumonia cases 
in Wuhan, the major transport hub of central China. 
The earliest human infections had occurred by early 
December 2019, and a large wet market in central 
Wuhan was linked to most, but not all, of the initial 
cases [2]. While evidence from the initial outbreak 
investigations seemed to suggest that 2019-nCoV 
could not easily spread between humans [3], it is now 
very clear that infections have been spreading from 
person to person [2]. We recently estimated that more 
than 75,000 infections may have occurred in Wuhan 
as at 25 January 2020 [4], and increasing numbers of 
infections continue to be detected in other cities in 
mainland China and around the world. A number of 
important characteristics of 2019-nCoV infection have 
already been identified, but in order to calibrate pub- 
lic health responses we need improved information on 
transmission dynamics, severity of the disease, immu- 
nity, and the impact of control and mitigation meas- 
ures that have been applied to date. 


Transmission dynamics 

Infections with 2019-nCoV can spread from person to 
person, and in the earliest phase of the outbreak the 
basic reproductive number was estimated to be around 
2.2, assuming a mean Serial interval of 7.5 days [2]. 
The serial interval was not precisely estimated, and 
a potentially shorter mean serial interval would have 
corresponded to a slightly lower basic reproductive 
number. Control measures and changes in population 
behaviour later in January should have reduced the 
effective reproductive number. However, it is too early 
to estimate whether the effective reproductive number 
has been reduced to below the critical threshold of 1 
because cases currently being detected and reported 
would have mostly been infected in mid- to late-Jan- 
uary. Average delays between infection and illness 
onset have been estimated at around 5-6 days, with 
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an upper limit of around 11-14 days [2,5], and delays 
from illness onset to laboratory confirmation added a 
further 10 days on average [2]. 


Chains of transmission have now been reported in a 
number of locations outside of mainland China. Within 
the coming days or weeks it will become clear whether 
sustained local transmission has been occurring in 
other cities outside of Hubei province in China, or in 
other countries. If sustained transmission does occur 
in other locations, it would be valuable to determine 
whether there is variation in transmissibility by loca- 
tion, for example because of different behaviours or 
control measures, or because of different environmen- 
tal conditions. To address the latter, virus survival stud- 
ies can be done in the laboratory to confirm whether 
there are preferred ranges of temperature or humidity 
for 2019-nCoV transmission to occur. 


In an analysis of the first 425 confirmed cases of infec- 
tion, 73% of cases with illness onset between 12 and 
22 January reported no exposure to either a wet mar- 
ket or another person with symptoms of a respiratory 
illness [2]. The lack of reported exposure to another 
ill person could be attributed to lack of awareness or 
recall bias, but China’s health minister publicly warned 
that pre-symptomatic transmission could be occurring 
[6]. Determining the extent to which asymptomatic or 
pre-symptomatic transmission might be occurring is 
an urgent priority, because it has direct implications 
for public health and hospital infection control. Data 
on viral shedding dynamics could help in assessing 
duration of infectiousness. For severe acute respiratory 
syndrome-related coronavirus (SARS-CoV), infectivity 
peaked at around 10 days after illness onset [7], con- 
sistent with the peak in viral load at around that time 
[8]. This allowed control of the SARS epidemic through 
prompt detection of cases and strict isolation. For 
influenza virus infections, virus shedding is highest 
on the day of illness onset and relatively higher from 
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TABLE. 


Research priorities to guide the public health response to 2019-nCoV 


Domain 


Priorities 


Study designs / data sources required 





Transmission 


Provide robust estimates of the serial interval and 
generation time 


Detailed exposure and illness onset information from 
unselected case clusters in line lists, preferably from more than 
one epicentre 





Estimate effective reproductive number (R) in other 
cities (i.e. ex-Wuhan) in China and elsewhere 


Epidemic curves for each city by dates of illness onset, 
preferably stratified by likely source of infection (zoonotic, 
environmental point source, local case vs imported index case) 





Clarify the relative importance of pre-symptomatic / 
asymptomatic transmission 


Detailed reports of transmission events and symptomatic status 
of infectors; viral shedding data; special studies in households 
and other closed settings 




















symptomatic cases, by age or other important 
groupings 


dynamics = = = 
Determine the role of different мә Transmission studies in households and other closed settings; 
transmission, particularly children : : 
serological studies 
Determine the relative importance of possible modes Outbreak investigauons, 2 particular for superspreading 
5 events, environmental sampling, air sampling and exhaled 
of transmission : : “ə 
breath sampling; special studies in households and other 
closed settings 
Determine environmental effects on virus survival Virus survival studies in situ vivo and in vitro; environmental 
and transmission sampling studies 
Provide robust estimates of the risk of fatality Reports from unselected clinical cohorts of times to death or 
of hospitalised cases, by age or other important 
: recovery among resolved cases 
groupings 
Severity Provide robust estimates of the risk of fatality of 


Estimates of incidence from population-wide surveillance of 
mild cases 





Identify groups at high risk of severe infection 


Case-control studies; cohort studies 








Susceptibility 


Determine if children are infected, and if so, if they 
are infectious 


Transmission studies in households and other closed settings; 
serological studies 





Determine if all infections result in neutralising 
immunity 


Convalescent serology from mild as well as severe cases, in all 
age groups 








Control measures 





Provide impact estimates of travel restrictions, 
border screening and quarantine policies on non- 
local spread 


Modelling analyses of local and global spread of infections 





Estimate the effects of social distancing measures 
and other non-pharmaceutical interventions on 
transmissibility 


Comparative analyses of transmissibility in different locations 








Predict the most effective measures to reduce the 
peak burden on healthcare providers and other 
societal functions 





Modelling studies incorporating healthcare capacity and 
processes 








shortly before symptom onset until a few days after 
onset [9]. To date, transmission patterns of 2019-nCoV 
appear more similar to influenza, with contagiousness 
occurring around the time of symptom onset, rather 
than SARS. 


Transmission of respiratory viruses generally happens 
through large respiratory droplets, but some respira- 
tory viruses can spread through fine particle aerosols 
[10], and indirect transmission via fomites can also 
play a role. Coronaviruses can also infect the human 
gastrointestinal tract [11,12], and faecal-oral transmis- 
sion might also play a role in this instance. The SARS- 
CoV superspreading event at Amoy Gardens where 
more than 300 cases were infected was attributed to 
faecal-oral, then airborne, spread through pressure 
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differentials between contaminated effluent pipes, 
bathroom floor drains and flushing toilets [13]. The first 
large identifiable superspreading event during the pre- 
sent 2019-nCoV outbreak has apparently taken place 
on the Diamond Princess cruise liner quarantined off 
the coast of Yokohama, Japan, with at least 130 pas- 
sengers tested positive for 2019-nCoV as at 10 February 
2020 [14]. Identifying which modes are important for 
2019-nCoV transmission would inform the importance 
of personal protective measures such as face masks 
(and specifically which types) and hand hygiene. 


Disease severity and immunity 

The first human infections were identified through a 
surveillance system for pneumonia of unknown aeti- 
ology, and all of the earliest infections therefore had 


pneumonia. It is well established that some infections 
can be severe, particularly in older adults with underly- 
ing medical conditions [15,16], but based on the gen- 
erally mild clinical presentation of 2019-nCoV cases 
detected outside China, it appears that there could 
be many more mild infections than severe infections. 
Determining the spectrum of clinical manifestations 
of 2019-nCoV infections is perhaps the most urgent 
research priority, because it determines the strength 
of public health response required. If the seriousness 
of infection is similar to the 1918/19 Spanish influenza, 
and therefore at the upper end of severity scales in 
influenza pandemic plans, the same responses would 
be warranted for 2019-nCoV as for the most severe 
influenza pandemics. If, however, the seriousness of 
infection is similar to seasonal influenza, especially 
during milder seasons, mitigation measures could be 
tuned accordingly. 


Beyond a robust assessment of overall severity, it is 
also important to determine high risk groups. Infections 
would likely be more severe in older adults, obese indi- 
viduals or those with underlying medical conditions, 
but there have not yet been reports of severity of infec- 
tions in pregnant women, and very few cases have 
been reported in children [2]. 


Those under 18 years are a critical group to study in 
order to tease out the relative roles of susceptibility vs 
severity as possible underlying causes for the very rare 
recorded instances of infection in this age group. Are 
children protected from infection or do they not fall ill 
after infection? If they are naturally immune, which is 
unlikely, we should understand why; otherwise, even if 
they do not show symptoms, it is important to know if 
they shed the virus. Obviously, the question about virus 
shedding of those being infected but asymptomatic 
leads to the crucial question of infectivity. Answers 
to these questions are especially pertinent as basis 
for decisions on school closure as a social distancing 
intervention, which can be hugely disruptive not only 
for students but also because of its knock-on effect for 
child care and parental duties. Very few children have 
been confirmed 2019-nCoV cases so far but that does 
not necessarily mean that they are less susceptible or 
that they could not be latent carriers. Serosurveys in 
affected locations could inform this, in addition to truly 
assessing the clinical severity spectrum. 


Another question on susceptibility is regarding whether 
2019-nCoV infection confers neutralising immunity, 
usually but not always, indicated by the presence of 
neutralising antibodies in convalescent sera. Some 
experts already questioned whether the 2019-nCoV 
may behave similarly to MERS-CoV in cases exhibiting 
mild symptoms without eliciting neutralising antibod- 
ies [17]. A separate question pertains to the possibil- 
ity of antibody-dependent enhancement of infection 
or of disease [18,19]. If either of these were to be rel- 
evant, the transmission dynamics could become more 
complex. 


Control and mitigation measures 

A wide range of control measures can be considered 
to contain or mitigate an emerging infection such as 
2019-nCoV. Internationally, the past week has seen an 
increasing number of countries issue travel advisories 
or outright entry bans on persons from Hubei prov- 
ince or China as a whole, as well as substantial cuts 
in flights to and from affected areas out of commercial 
considerations. Evaluation of these mobility restric- 
tions can confirm their potential effectiveness in delay- 
ing local epidemics [20], and can also inform when as 
well as how to lift these restrictions. 


If and when local transmission begins in a particular 
location, a variety of community mitigation measures 
can be implemented by health authorities to reduce 
transmission and thus reduce the growth rate of an epi- 
demic, reduce the height of the epidemic peak and the 
peak demand on healthcare services, as well as reduce 
the total number of infected persons [21]. A number of 
social distancing measures have already been imple- 
mented in Chinese cities in the past few weeks includ- 
ing school and workplace closures. It should now 
be an urgent priority to quantify the effects of these 
measures and specifically whether they can reduce the 
effective reproductive number below 1, because this 
will guide the response strategies in other locations. 
During the 1918/19 influenza pandemic, cities in the 
United States, which implemented the most aggressive 
and sustained community measures were the most 
successful ones in mitigating the impact of that pan- 
demic [22]. 


Similarly to international travel interventions, local 
social distancing measures should be assessed for 
their impact and when they could be safely discon- 
tinued, albeit in a coordinated and deliberate manner 
across China such that recrudescence in the epidemic 
curve is minimised. Mobile telephony global position- 
ing system (GPS) data and location services data from 
social media providers such as Baidu and Tencent in 
China could become the first occasion when these data 
inform outbreak control in real time. 


At the individual level, surgical face masks have often 
been a particularly visible image from affected cities 
in China. Face masks are essential components of per- 
sonal protective equipment in healthcare settings, and 
should be recommended for ill persons in the com- 
munity or for those who care for ill persons. However, 
there is now a shortage of supply of masks in China 
and elsewhere, and debates are ongoing about their 
protective value for uninfected persons in the general 
community. 


The Table summarises research gaps to guide the pub- 
lic health response identified. 


In conclusion, there are a number of urgent research 


priorities to inform the public health response to the 
global spread of 2019-nCoV infections. Establishing 
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robust estimates of the clinical severity of infections 
is probably the most pressing, because flattening out 
the surge in hospital admissions would be essential if 
there is a danger of hospitals becoming overwhelmed 
with patients who require inpatient care, not only for 
those infected with 2019-nCoV but also for urgent 
acute care of patients with other conditions including 
those scheduled for procedures and operations. In 
addressing the research gaps identified here, there is 
a need for strong collaboration of a competent corps 
of epidemiological scientists and public health workers 
who have the flexibility to cope with the surge capacity 
required, as well as support from laboratories that can 
deliver on the ever rising demand for diagnostic tests 
for 2019-nCoV and related sequelae. The readiness sur- 
vey by Reusken et al. in this issue of Eurosurveillance 
testifies to the rapid response and capabilities of labo- 
ratories across Europe should the outbreak originating 
in Wuhan reach this continent [23]. 


In the medium term, we look towards the identifica- 
tion of efficacious pharmaceutical agents to prevent 
and treat what may likely become an endemic infection 
globally. Beyond the first year, one interesting possibil- 
ity in the longer term, perhaps borne of wishful hope, 
is that after the first few epidemic waves, the subse- 
quent endemic re-infections could be of milder sever- 
ity. Particularly if children are being infected and are 
developing immunity hereafter, 2019-nCoV could opti- 
mistically become the fifth human coronavirus causing 
the common cold. 


Editorial note 
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Timely detection of novel coronavirus (2019-nCoV) 
infection cases is crucial to interrupt the spread of this 
virus. We assessed the required expertise and capac- 
ity for molecular detection of 2019-nCoV in specialised 
laboratories in 30 European Union/European Economic 
Area (EU/EEA) countries. Thirty-eight laboratories in 
24 EU/EEA countries had diagnostic tests available by 
29 January 2020. A coverage of all EU/EEA countries 
was expected by mid-February. Availability of prim- 
ers/probes, positive controls and personnel were main 
implementation barriers. 


In early January 2020, it became evident that a new 
pathogenic human coronavirus, provisionally named 
novel coronavirus (2019-nCoV), had emerged in China 
[1,2]. The virus is causing an outbreak, which started 
in the metropole Wuhan, but was seeded through trav- 
ellers across China with ongoing secondary chains of 
transmission in a wider geographical area. As at 10 
February 2020, 40,553 confirmed cases including 910 
deaths have been reported worldwide with an increas- 
ing number of cases being reported in Europe [3]. So 
far, instances of secondary spread from international 
travellers have been limited, but clusters of human-to- 
human transmission have been reported involving per- 
sons with close contact to confirmed cases [4]. A key 
knowledge gap is the efficiency of community trans- 
mission of 2019-nCoV, including the contribution of 
mild or asymptomatic cases. On 30 January 2020, the 
Word Health Organization (WHO) declared the outbreak 
a public health emergency of international concern 
(PHEIC) because of these uncertainties, the ongoing 
seeding of the virus internationally, and the need for 
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preparedness across the world in order to track and 
control the epidemic. WHO highlighted the crucial role 
of early detection of cases to interrupt virus spread and 
emphasised that countries need to put in place strong 
measures to detect and laboratory-confirm cases early 
[5]. Here, we assessed the required expertise and 
diagnostic capacity in specialised laboratories in 30 
European Union/European Economic Area (EU/EEA) 
countries. 


Survey 

A questionnaire was designed to assess the capac- 
ity, quality and operational specifics related to 2019- 
nCoV diagnostics, as well as barriers against their 
implementation in laboratories that are part of the 
European Centre for Disease Control and Prevention 
(ECDC)-associated European expert laboratory network 
for emerging viral diseases (EVD-LabNet) and/or the 
European Reference Laboratory Network for Human 
Influenza (ERLI-Net). The survey was sent on 22 January 
2020 to the Operational Contact Points representing 
81 laboratories in, among others, 30 EU/EEA coun- 
tries. The survey subsequently closed on 29 January 
2020 (Figure 1). Where indicated, data were validated 
by individual email exchange with the laboratories to 
include one entry per laboratory. Entries from labora- 
tories outside the EU/EEA and veterinary laboratories 
were omitted from analysis for this report. In total, the 
data provided by 47 laboratories in 30 EU/EEA coun- 
tries were taken into account in this study. 


FIGURE 1 


Time-line with hallmark events of the first two months of the novel coronavirus (2019-nCoV) outbreak, December 2019- 
January 2020 
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CoV: corona virus; E gene: envelope gene of 2019-nCoV; EVAg: European Virus Archive - GLOBAL; GISAID: Global Initiative on Sharing All 
Influenza Data; HCoVs: human coronaviruses; 2019-nCoV: novel coronavirus; PHEIC: public health emergency of international concern; SARS- 
CoV: severe acute respiratory syndrome corona virus; WHO: World Health Organization. 


2 Of the initial 41 people who were hospitalised in Wuhan by 2 January 2020 with pneumonia due to a confirmed 2019-nCoV infection, 27 had 


an epidemiological link to the Huanan market [18]. 


> https://www.who.int/docs/default-source/coronaviruse/protocol-v2-1.pdf?sfvrsn=agef618c_2 


c https://www.european-virus-archive.com/nucleic-acid/wuhan-coronavirus-2019-e-gene-control and https://www.europeanvirus-archive. 


com/nucleic-acid/sars-cov-frankfurt-ı 


d The five HCoVs included HCoV-NL63, HCoV-OC43, HCoV-229E, MERS-CoV, SARS-CoV. More information is available at: https://www. 


european-virus-archive.com/nucleic-acid/coronavirus-rna-specificity-panel 


Capacity for novel coronavirus molecular 
diagnostics 

At country level, 24 of 30 EU/EEA countries had already 
implemented molecular tests for 2019-nCoV while 
the laboratories in the remaining six countries had 
arranged to ship clinical specimens of suspected cases 
to a specialised laboratory abroad, while planning to 
implement assays between 30 January and 17 February 
2020. At the laboratory level, 38 of 47 responding labo- 
ratories had implemented molecular diagnostics for 
2019-nCoV at survey submission, and eight of the nine 
remaining laboratories planned to have tests imple- 
mented by mid-February 2020 (Figure 2). Nineteen lab- 
oratories indicated to have capacity to perform whole 
genome sequencing on 2019-nCoV in clinical samples, 
while 15 laboratories could perform partial sequencing. 


The laboratories were asked to indicate their weekly 
capacity for molecular testing for 2019-nCoV (Figure 
3). Overall, for all 38 laboratories with current capac- 
ity this was indicated to be at a minimum of 8,275 


tests per week. The eight laboratories in the process 
of implementing molecular diagnostics would, all com- 
bined, add a minimum capacity of 875 tests per week 
once this process would be complete. 


Expertise for coronavirus and other 
respiratory pathogens 

Forty-five laboratories in 28 countries indicated having 
previous expertise in human coronavirus (HCoV) diag- 
nostics. For two countries the two responding labora- 
tories had no experience. Twenty-five laboratories in 
19 countries indicated having experience in molecular 
diagnostics for all six additional HCoVs (HCoV-HKU1, 
HCoV-0C43, HCoV-NL63, HCoV-229E, Middle East res- 
piratory syndrome CoV and severe acute respiratory 
syndrome CoV) [6]. Forty-four laboratories in 29 coun- 
tries performed differential testing for other common 
respiratory pathogens of viral and bacterial origin. 
Overall, the 47 survey respondents indicated their 
ability to process a wide range of respiratory sam- 
ple types, including nasopharyngeal swabs (n=38), 
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FIGURE 2 


Status of availability of molecular diagnostics for novel coronavirus (2019-nCoV) in EU/EEA countries as at 29 January 


2020 (n=46 laboratories)* 
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EU/EEA: European Union/European Economic Area; 2019-nCoV: 2019 novel coronavirus. 


2 One laboratory of the 47 included in the current study did not indicate when its molecular diagnostics would be available. 


bronchoalveolar lavage (n=36), oropharyngeal swab 
(n=34), nasopharyngeal aspirate (n=34), sputum 
(n=34), (endo) tracheal aspirate (n=32) and nasal 
wash (n=29). In addition, a number of respondents 
indicated that their laboratories could process biopsy 
materials (n=28) and whole blood, plasma, serum 
(п = 28) Гог 2019-nCoV detection. 


Implementation of molecular diagnostics 
for novel coronavirus 


Biosafety level 

For the biosafety-level (BSL) applied for inactivation of 
clinical samples suspected of 2019-nCoV, 22 laborato- 
ries of the 47 EU/EEA laboratories indicated to do this 
at BSL2. Twenty-one laboratories indicated to do so at 
BSL3. Four laboratories indicated an intermediate level 
BSL2+(BSL2 with extra precautions such as wearing a 
filtering face piece (FFP)2 mask). Different approaches 
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were observed between laboratories within some 
countries. 


Test specifics 

As of 14 January 2020, protocols for RT-PCR of 2019- 
nCoV are being published on the WHO website [7]. At 
survey closure (29 January 2020), the envelope (E)-gene 
screening test as published by Corman et al. [6,7], had 
been implemented by 35 laboratories and the confirma- 
tory RNA-dependent RNA polymerase (RdRp)-gene test 
and nucleoprotein (N)-gene test by respectively 33 and 
21 laboratories. Sixteen laboratories indicated to have 
additional tests, i.e. in house tests (n=5), pan-CoV 
tests (n=12) or an assay based on Poon et al. (n=1) [7]. 
Two laboratories indicated to base 2019-nCoV testing 
solely on previously published pan-CoV tests [8]. 


FIGURE 3 


Diagnostic capacity of specialised laboratories with 
molecular tests available or forthcoming for novel 
coronavirus (2019-nCoV), EU/EEA, January 2020 (n=46)* 
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2 One laboratory of the 47 included in the current study did not 
indicate when its molecular diagnostics would be available. 


Level of specificity validation 

Only 11 laboratories of the 38 laboratories that had 
implemented testing indicated having validated the 
specificity of the implemented test against the six addi- 
tionally known HCoVs and other common respiratory 
pathogens. For 15 laboratories, specificity validation 
was Still in progress at the time of data submission. 
Seven laboratories indicated to have only partially vali- 
dated the implemented test(s) while five laboratories 
had not (yet) performed any validation. The question- 
naire was send out before the first 2019-nCoV cases 
appeared in Europe (Figure 1) and positive clinical 
specimens were assumed to be not available to the 
European laboratories. Therefore, the level of valida- 
tion for clinical sensitivity was not assessed. 


Positive control 

Three of 38 laboratories that had implemented diag- 
nostics did the implementation without a positive con- 
trol. Indicated sources for positive controls were the 
European Virus Archive (EVAg) (synthetic 2019-nCoV 
E-gene, SARS-CoV RNA) (n=23) [9], or own stocks, i.e. 
SARS-HCoV RNA and/or synthetic RNA (n=15). 


Diagnostic challenges 


The top three challenges that were experienced for test 
implementation were an initial lack of positive control, 
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lack of personnel/time and a lack of primers and/or 
probes (Figure 4). Nine laboratories in eight countries 
indicated no obstacles. 


Discussion 

As at 10 February 2020, 37 confirmed 2019-nCoV cases 
were reported from eight European countries based 
on ECDC reporting and testing criteria [3,10]. Multiple 
modelling studies estimated the risk of 2019-nCoV 
introduction to Europe as high [11-14]. Pullano et al. 
indicated the United Kingdom, France and Germany as 
being at the highest risk, followed by Italy, Spain and 
the Netherlands [11]. Indeed, all but one country (the 
Netherlands) have reported cases. The study reported 
that the occurrence of 2019-nCoV importation from 
Beijing and Shanghai, both cities with high numbers of 
travellers to Europe, would likely lead to an even higher 
and widespread risk for Europe. 


This rapid assessment of the readiness of EU/EEA labo- 
ratories for molecular detection of 2019-nCoV demon- 
strated a fast implementation of molecular diagnostics 
by the European specialised laboratory networks with 
a good geographical coverage for testing. Among both 
laboratory networks in this study, protocols were 
shared rapidly and there was an early availability of 
positive controls and CoV specificity panels via EVAg. 
Furthermore, the survey indicated a great willingness 
of laboratories to provide international diagnostic sup- 
port [10] and to share sequences to contribute to the 
monitoring of virus evolution and trace transmission 
chains. 


However, although the first protocols suggesting 
primer/probe sequences were available fast through 
the WHO website (Figure 1) and validation panels were 
made available through the EVAg portal soon after 
[6,7], the availability of primers, probes and posi- 
tive controls were indicated as most important initial 
obstacles for test implementation. In addition, lack of 
sufficient personnel to implement and validate was a 
barrier, as had been observed in response to the Zika 
virus (ZIKV) outbreak in the Americas and the related 
PHEIC [15]. This suggests that the challenges faced by 
specialised laboratories when responding to emerging 
events are of structural nature. 


Capacity-wise, the survey indicates that European 
specialised laboratories are prepared for the current 
situation, and suggests that a more sensitive case 
definition than currently in use [10,16] would not cre- 
ate an immediate bottleneck. However, it remains to 
be seen how realistic the estimates are, particularly 
in view of the coinciding seasonal epidemic peaks of 
other respiratory pathogens such as influenza viruses. 
This will depend on the epidemiological developments 
in the 2019-nCoV outbreak and on whether the current 
worldwide control strategy of containment with active 
case finding [5] will be sustained and the indicated lab- 
oratory capacity will suffice. If the outbreak turns into 
a pandemic, specialised laboratories’ efforts would 
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FIGURE 4 


Challenges reported by laboratories in terms of implementing molecular diagnostics for novel coronavirus (2019-nCoV), 


EU/EEA, January 2020 (n=47) 
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refocus to reference activities like confirmatory testing, 
laboratory surveillance including virus characterisa- 
tion, provision of reference materials and advice, while 
general testing for 2019-nCoV would shift to first-line 
hospital laboratories that currently do not have this 
capacity. This would require a roll-out of tests from the 
specialised laboratories as was done during the 2009 
influenza A(H1N1) pandemic. 


The survey showed that proper validation of specificity 
was lacking in a vast majority of the laboratories that 
had implemented testing while very few laboratories 
indicated to have implemented tests without availabil- 
ity of a positive control. The important assessment of 
the clinical sensitivity of the implemented tests was not 
possible in this very early phase of laboratory response 
due to the, at the time, absence of positive clinical 
materials in Europe. The three laboratories without a 
positive control will also not have assessed the ana- 
lytical sensitivity of their tests. The legal possibilities 
(General Data Protection Regulation; GDPR) for sharing 
and the willingness to share positive clinical material 
among the network laboratories now that the first 37 
cases have been confirmed in the EU/EEA will deter- 
mine the speed with which laboratories can address 
the clinical sensitivity of their implemented tests while 
the number of cases in the EU/EEA is still limited. 


To properly assess the actual capability of the labora- 
tories to detect (sub)clinical 2019-nCoV cases and to 
provide directions for corrective actions, proficiency 
testing by external quality assessment (EQA) is essen- 
tial and urgently needed. The importance of EQA was 
illustrated in the European ZIKV response where timely 
implementation was not matched by an overall good 
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capability [17]. Forty of the 47 responding laborato- 
ries in this study indicated that they will participate in 
such an assessment. Currently activities are ongoing 
to assess the actual capabilities within both laboratory 
networks by EQA. 


In conclusion, while molecular testing for 2019-nCoV 
was quickly implemented in EU/EEA countries there is 
still room for improvement especially in the aspect of 
clinical validation of specificity and sensitivity, as could 
be expected considering the survey was taken in the 
very early phase of the laboratory response. Capability 
testing based on proficiency panels is needed. 


Editorial note 





This article was published as an e-Alert on 11 February 2020. 
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In Tuscany, Italy, New Delhi metallo-beta-lactamase- 
producing carbapenem-resistant Enterobacterales 
(NDM-CRE) have increased since November 2018. 
Between November 2018 and October 2019, 1,645 
samples were NDM-CRE-positive: 1,270 (77.2%) cases 
of intestinal carriage, 129 (7.8%) bloodstream infec- 
tions and 246 (14.9%) infections/colonisations at 
other sites. Klebsiella pneumoniae were prevalent 
(1,495; 90.9%), with ST147/NDM-1 the dominant clone. 
Delayed outbreak identification and response resulted 
in sustained NDM-CRE transmission in the North-West 
area of Tuscany, but successfully contained spread 
within the region. 


An increase in isolates of NDM-producing carbape- 
nem-resistant Enterobacterales (NDM-CRE) in sam- 
ples obtained from patients admitted to hospitals in 
the North-West (NW) area of Tuscany has been reg- 
istered since the last months of 2018 [1], leading, in 
March 2019, to the recognition by the Tuscany Regional 
Department of Health (RDH) of an outbreak situation 
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and to the establishment of a multidisciplinary regional 
task force (RTF) to coordinate response activities. 


Here we describe the spatial and temporal trend of 
NDM-CRE incidence in Tuscany since the emergence of 
the outbreak and the public health measures adopted. 


Prevention and response activities 

Health services in Tuscany, a region of 3.7 million 
inhabitants in the centre of Italy, are managed by the 
RDH in three sub-regional areas: NW with a population 
of 1,200,000 and 3,000 hospital beds, Central with a 
population of 1,500,000 and 3,000 hospital beds and 
South-East (SE) with a population of 800,000 and 
1,600 hospital beds. Each area comprises one teach- 
ing hospital (TH), a number of district hospitals (DH) 
and smaller hospitals. Following the increase in NDM- 
CRE cases, the RDH adopted a series of measures 
(Figure 1) including intensified case detection activi- 
ties, expanded routine screening of patients admitted 
to hospitals or specific hospital wards beyond usual 
practice (from June 2019), definition of standardised 
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FIGURE 1 


Actions to control the outbreak of NDM-CRE cases, by week of implementation, Tuscany, Italy, November 2018-October 
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procedures for case management, data collection 
and infection control, and patient safety management 
aligned vvith international, national and regional guide- 
lines [2]. 


Before the introduction of the expanded screening pro- 
gramme of newly admitted patients, the region-wide 
average number of tests performed per month was 
7,500. The number increased to 10,275 in July, 10,974 
in August and 19,174 in September, reaching 31,465 in 
October (Figure 2A). The scale-up of molecular diag- 
nostics use in October 2019 allowed for faster identi- 
fication of NDM cases. Distribution of the screenings 
performed by area revealed that half of the samples 
(51.7%) were collected in the NW area, followed by 
Central (35.5%) and SE (12.8%), with the higher num- 
ber in the NW area largely attributable to contact trac- 
ing activities in addition to routine screening. 


Following detection of NDM-CRE carriage/infection, 
patients were placed under standard contact precau- 
tions. Patient and staff cohorting was implemented 
where necessary, depending on available infrastructure 
(e.g. single rooms) and number of affected patients. 


Epidemiological investigation 

A case was defined as any individual referring to a 
healthcare facility in Tuscany as an in- or outpatient 
and for whom the presence of microbiologically con- 
firmed NDM-CRE was detected in any biological sam- 
ple between 1 November 2018 and 31 October 2019. 
Cases were classified as: intestinal carriage (isolation 
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from surveillance rectal swabs), bloodstream infec- 
tions (BSI; isolation from blood samples), colonisation 
or infection at other sites (isolation from the urinary or 
respiratory tract or other sites). Individuals with multi- 
ple isolations during the same hospitalisation episode 
were classified according to the most clinically relevant 
sample. 


A dedicated standardised data collection form was 
developed to gather relevant information on identified 
cases from November 2018 onwards, including patient 
characteristics, hospitalisation-related data and micro- 
biological data. 


Data were collected by the laboratories and infection 
control teams of TH and DH and submitted weekly 
(cases) or monthly (screening samples) to the Regional 
Health Agency. Data were analysed based on time of 
isolation, geographical area and hospital or health 
facility. Cases were stratified by type, bacterial spe- 
cies and, for inpatients, ward or unit (intensive care 
units (ICU), surgical/medical wards (non-ICU), long- 
term care units (LTCU)). Rates were calculated as new 
cases occurring during the study period by total days 
of hospitalisation per healthcare facility, using esti- 
mates for the same period in the previous calendar 
year. Analyses were performed using STATA/SEv.14.2. 


A total of 1,645 cases with NDM-CRE-positive micro- 
biological samples were identified in the period from 
1 November 2018 to 31 October 2019. Of these, 1,270 
(77.2%) were cases of intestinal carriage, 129 (7.8%) 
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FIGURE 2 


Number of tests and epidemic curve of NDM-CRE cases by week of detection, Tuscany, Italy, November 2018-October 2019 


(n = 1,645) 
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BSI (one of them from a non-hospitalised patient), and 
246 (15.0%) carriage/infection at other sites (urinary 
tract (480; 10.9%), other sites (66; 4.0%)) (Figure 2). 
Regarding sex and age distribution, 656 (41.3%) cases 
were male and 934 (53.7%) female (55 unknown) and 
the median age was 76 years (range: 0-99 years). 
There were differences in age distribution (Kolmogorv— 
Smirnov test) between male (median age: 74 years) and 
female cases (median age: 80 years). 


Most of the cases (1,496; 90.9%) were inpatients 
(shown in the Table), while a minority (149; 9.1%) were 
outpatients (e.g. community healthcare services). The 
majority of all cases (1,391; 84.6%) and of hospitalised 
cases (1,264; 84.5%) were reported in the NW area, 
where all TH and DH reported at least one case (data 
not shown), with the TH and other four DH reporting 
more than half of the total hospitalised cases in the 
area (Table). The majority of cases were hospitalised 
on wards other than ICU at the time of NDM-CRE detec- 
tion (Table). 


According to the available data, a cluster of NDM-CRE 
cases occurred in November 2018 in the NW area, fol- 
lowed by increasing detection from mid-December 
2018. The epidemic curve for the NW area shows an 
initial peak in mid-February 2019, followed by a further 
increase over the month of April 2019 (Figure 3A). 


The introduction of standardised routine screening of 
newly admitted patients across Tuscany in June 2019 
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resulted in a progressive increase in NDM-CRE detec- 
tion in all TH and DH until September 2019, when a 
declining trend was noticed (Figures 1 and 3A). The dis- 
tribution of cases over time was similar across DH in the 
NW area, with all facilities showing an epidemic curve 
with multiple peaks (data not shown). Cases in other 
areas of Tuscany occurred later in 2019 and were fewer 
(Figure 3B and C). NDM-CRE BSI cases were observed 
during the entire study period in the NW area, remain- 
ing sporadic elsewhere (Figures 2B and 3), as shown in 
the map (Figure 4). 


Microbiological investigation 

Microbiological analyses of samples were performed 
by the TH and DH laboratories following their standard 
protocols. Identification at the species level was car- 
ried out by MALDI-ToF mass spectrometry using either 
VitekMS (bioMérieux, Marcy-Ľ Etoile, France) or MALDI 
Biotyper (Bruker Daltonics, Bremen, Germany) or by bio- 
chemical profiling (Vitek2, bioMérieux, Marcy-ĽEtoile, 
France). The presence and nature of carbapenemase 
determinants was determined by molecular testing of 
bacterial isolates using either PCR-based platforms 
(Xpert-CarbaR, Cepheid, Toulouse, France; Allplex, 
Seegene Inc, Seoul, Korea) or lateral flow immuno- 
chromatography systems (Resist-5 OOKNV, CorisBio, 
Gembloux, Belgium ). Whole genome sequencing 
(WGS) was performed on BSI isolates as described 
previously [3]. 
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TABLE 
NDM-CRE inpatient cases per health facility of detection, Tuscany, Italy, November 2018-October 2019 (n = 1,496) 









































Confirmed NDM-CRE cases echo ol cl 4 
Per case definition Per ward do 
hospital 
Hospital type (n) Intestinal Other than days: 
Total carriage 57 sd ICU Hol 
BSI 
n % 
TH (n = 1) 290 231 | 79.7 45 | 15.5 | 14 | 4.8 | 52 | 17.9] 219 | 75.5] 4 14 İ 15 İ 5.2 15.46 
DH (n = 4) 727 | 594 | 81.7 | 45 | 6.2 | 88 | 12.1] 92 | 12.7| 567 |78.0] 56 | 7.7 | 12 | 1.7 9.97 
North-West 
Other? (n = 11) 247 | 178 | 72.1 | 24 | 9.7 | 45 |18.2] 17 | 6.9 | 108 | 43.7] 108 | 43.7] 14 | 5.7 12.84 
All facilities 1,264 | 1,003 | 79.4 | 114 | 9.0 | 147 | 11.6 | 161 | 12.7 | 894 | 70.7 | 168 | 13.3 | 41 | 3.2 11.84 
TH (n =1) 26 25 İ 96.2 1 3.81 o o 3 / 11.5] 23 |88.5| o о О | О. 0.32 
бәк ОН (п = 5) 64 58 | 90.6 1 1.6 7.8 İ ız 118.8İ 47 İ73.Aİ O o 5 17.8 0.19 
entra 
Other” (n — 8) 27 25 92.6 1 3.7 səl 2 1274 19 |70.4| 4 |14.8| 2 |7.4 0.64 
All facilities 117 108 | 92.3 3 2.6 6 5.1 | 17 114.5] 89 | 76.1) 4 | 3.4 | 7 | 6.0 0.3 
TH (n =1) 52 37 İ 712 4 7-7 | 11 | 21.2] 11 | 21.2] 41 |78.8] 0 o | 0 |o.0 2.35 
DH (n = 2) 12 7 58.3 o o 41.7] 2 | 16.7 9 75.0| 1 | 8.3 | 0 | 0.0 о 
South-East 
Other? (n = 13) 51 35 68.6 7 | 13.7 17.6| 4 | 7.8 30 İ158.8İ 17 | 33.3] 0 | 0.0 3.32 
All facilities 115 79 68.7 11 İ 9.6 İ 25 | 21.7] 17 |14.8| 80 |69.6| 18 | 15.7 | 0 | 0.0 1.9 
57” All facilities 1,496 | 1,190 | 79.5 | 128 | 8.6 | 178 | 11.9 | 195 | 13.0 | 1,063 | 71.1 | 190 | 12.7 | 48 | 3.2 5.02 



























































BSI: bloodstream infection; DH: district hospital; ICU: intensive care unit; LTCU: long-term care unit; NA: ward data not available; NDM-CRE: 
New Delhi metallo-beta-lactamase-producing carbapenem-resistant Enterobacterales; TH: teaching hospital. 


a Hospitalisation days were calculated based on data for the corresponding months in the previous calendar year. 
> Other facilities include all hospitals not included in the former categories, e.g. primary hospitals, excluding long-term care facilities. 


The large majority of confirmed NDM-CRE 
were Klebsiella pneumoniae (n=1,495; 90.9%), followed 
by other Enterobacterales including Escherichia 
coli (n=69; 4.2%), Enterobacter hormaechei (n=2; 
0.1%), Citrobacter freundii (n=1; 0.1%) and unspecified 
NDM-CRE (n=77; 4.7%). 


Fifty-one unique NDM-positive isolates of K. pneu- 
moniae from BSI were characterised by WGS. These 
isolates were from 12 different hospitals, mostly from 
the area where the outbreak had emerged. Of these 
isolates, 49 had been collected during the period from 
November 2018 to June 2019 and represented 92% of the 
53 invasive isolates collected in the same period, while 
two had been collected earlier (uly and September 
2018). Most of the 51 isolates belonged to the ST147 
lineage and carried the bla ,,,,, gene (n=49; 96%), 
including the first two isolates collected in summer 
2018. Analysis of single nucleotide polymorphisms 
carried out with core genomes (cgSNP) revealed that 
all 49 ST147 isolates were closely related to each other 
(cgSNP range: 1-37; mean: 16; median: 17), suggesting 
that clonal expansion of a single NDM-1-producing K. 
pneumoniae strain had played a major role at least in 
the beginning of the outbreak. 


Limitations 

This study has some limitations. Heterogeneity in 
screening practice and coverage across the region, 
imperfect identification of re-admissions and 
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sub-optimal detection of microbiologically confirmed 
cases before recognition of the outbreak may have 
affected the accuracy of the present assessment. 
Furthermore, the reliance on paper-based data collec- 
tion systems in some facilities and lengthy data colla- 
tion and validation processes hampered our capacity 
to extend the present study period beyond week 44 
of 2019. While the molecular characterisation data 
presented in this study are representative of the early 
phase of the outbreak, further analyses are needed to 
characterise invasive isolates collected in the second 
half of 2019. 


Public health implications and conclusions 
NDM-CRE are able to hydrolyse almost all beta-lactams 
and are not inhibited by currently available beta-lacta- 
mase inhibitors, including the new ones avibactam and 
vaborbactam [4]. NDM-CRE were first described in 2008 
in Sweden and subsequently reported across Europe 
[1,5], resulting in growing concern for these pathogens 
to become endemic in the region [6,7]. In Italy, a coun- 
try where CRE are reported at endemic level [8], NDM- 
CRE were first detected in 2009 [9,10] and sporadic, 
often travel-related, cases have been recorded since 
[5]. This was also the case in Tuscany until November 
2018, when a noticeable increase of NDM-CRE isolates 
was registered [1]. 


This is a report of a large and persistent outbreak in 
an Italian region, probably caused by a single-clone 
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FIGURE 3 
Epidemic curve, NDM-CRE cases, by week of detection and area, Tuscany, Italy, November 2018-October 2019 (n = 1,645) 
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NDM-CRE, highlighting the risk of rapid emergence and 
disseminations of uncommon variants of CPE within 
healthcare facility networks, as recently reported in 
other European countries [6,7]. Tuscany has a compre- 
hensive and effective microbiological surveillance sys- 
tem, yet the increase in NDM-CRE cases was detected 
with some delay. This was probably due to the following 
circumstances: (i) Italy is a setting of high endemicity 
for CRE and occurrence of CRE isolates was not unex- 
pected, (ii) the routine surveillance system is based 
on phenotypic resistance profiles to various indicator 
antibiotics, not including those suggestive of NDM- 
CRE emergence (e.g. ceftazidime-avibactam), (iii) CRE 
resistance mechanisms were not routinely searched 
and (iv) data integration and analysis in the laboratory 
information systems are not automatised. 


Delayed outbreak identification compromised the 


implementation of a rapidly effective response to con- 
tain NDM-CRE spread across healthcare facilities in the 
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NW area. However, the set-up of a regional RTF and 
the coordinated roll-out of a comprehensive bundle of 
interventions was successful in preventing the spread 
within the Central and SE areas. During the outbreak, 
infection control protocols were streamlined, combin- 
ing the contact precautions protocols that were already 
present with organisational improvements such as 
cohorting of staff and patients. Most of the efforts 
were directed towards early case finding and expand- 
ing screening protocols in all wards and health facili- 
ties. Before the outbreak, routine screening with rectal 
swabs was performed heterogeneously across Tuscany 
and largely targeted towards patients admitted to ICU 
or towards immunocompromised patients, e.g. patients 
admitted to a haematology ward. 


The three sub-regional areas have a nearly closed 
patient referral system, with patients circulat- 
ing between the TH and DH/other smaller hospitals 
located within each area. This referral pathway may 
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FIGURE 





Health facilities and numbers of NDM-CRE bloodstream 
infections, Tuscany, Italy, November 2018-October 2019 
(n = 129) 
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have enhanced circulation of NDM-CRE through a com- 
bination of different mechanisms. While intra-hospital 
transmission has probably been substantial, inter-hos- 
pital and community-to-hospital circulation through 
patients navigating the health system with multiple 
admissions across different health facilities are prob- 
able reasons for the geographical spread [11,12], at 
least within the NW area [13]. However, the same self- 
sufficiency of the Health Services within each area is 
likely to have contributed to confining the circulation of 
cases within their borders. 


Conclusion 

The emergence of NDM-CRE strains in Tuscany, where 
CRE K. pneumoniae circulation within healthcare 
facilities is already sustained [14], is of great concern 
as therapeutic options remain very limited. Despite the 
observed decreasing trend in the number of new cases 
detected since October 2019, continued monitoring of 
NDM-CRE transmission is required to assess the risk of 
further spread within and beyond Tuscany region. 
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A novel coronavirus (severe acute respiratory syn- 
drome coronavirus 2, SARS-CoV-2) causing a cluster 
of respiratory infections (coronavirus disease 2019, 
COVID-19) in Wuhan, China, was identified on 7 January 
2020. The epidemic quickly disseminated from Wuhan 
and as at 12 February 2020, 45,179 cases have been 
confirmed in 25 countries, including 1,116 deaths. 
Strengthened surveillance was implemented in France 
on 10 January 2020 in order to identify imported cases 
early and prevent secondary transmission. Three cat- 
egories of risk exposure and follow-up procedure were 
defined for contacts. Three cases of COVID-19 were 
confirmed on 24 January, the first cases in Europe. 
Contact tracing was immediately initiated. Five con- 
tacts were evaluated as at low risk of exposure and 
18 at moderate/high risk. As at 12 February 2020, two 
cases have been discharged and the third one remains 
symptomatic with a persistent cough, and no second- 
ary transmission has been identified. Effective collab- 
oration between all parties involved in the surveillance 
and response to emerging threats is required to detect 
imported cases early and to implement adequate con- 
trol measures. 
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Background 

A novel coronavirus (severe acute respiratory syndrome 
coronavirus 2, SARS-CoV-2) causing a cluster of res- 
piratory infections (coronavirus disease 2019, COVID- 
19) in Wuhan, China, was identified on 7 January 2020 
[1]. Twenty-seven patients with pneumonia had initially 
been reported, with an epidemiological link to a live 
animal market that was closed and disinfected on 1 
January [1]. From 20 January, the number of notifica- 
tions of cases rose dramatically, and as at 12 February 
2020, 45,179 cases of SARS-CoV-2 have been con- 
firmed, including 1,116 deaths [2]. Most of the cases 
(n = 44,665) were reported in 31 provinces and autono- 
mous regions of China and 514 cases were reported in 
25 other countries in Asia, Australia, Europe and North 
America [2]. To date, the primary source of infection 
remains unknown and could still be active. Human- 
to-human transmission was observed early after the 
emergence of this new virus in China and abroad, 
including family clusters and healthcare settings. The 
current outbreak dynamics strongly indicate sustained 
human-to-human transmission. 


Strengthened surveillance of COVID-19 cases was 
implemented in France on 10 January 2020. The 
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TABLE 


Definition of a contact and follow-up procedure by level of risk of infection, COVID-19, France, January 2020 


Level of risk of 
infection 


Contact definition 


Follow-up procedure 





Negligible risk 


Person who had short (< 15 min) contact with a confirmed 
case in public settings such as in public transportation, 
restaurants and shops; healthcare personnel who treated a 
confirmed case while wearing appropriate PPE without any 
breach identified. 


Neither identification nor information of contacts. 





Low risk 


Person who had a close (within 1m) but short («15 min) 
contact with a confirmed case, or a distant (»1m) but 
prolonged contact in public settings, or any contact in private 
settings that does not match with the moderate/high risk of 
exposure criteria. 


Contacts are asked to measure their body temperature 
twice a day and check for clinical symptoms. In 
case of occurrence of symptoms like fever, cough 
or dyspnoea, contacts are asked to wear a surgical 
mask, isolate themselves and immediately contact the 
emergency hotline (SAMU-centre 15) indicating that 
they are contacts of a confirmed COVID-19 case. 





Moderate/high risk 


Person who had prolonged (>15 min) direct face-to-face 
contact within 1m with a confirmed case, shared the same 
hospital room, lived in the same household or shared any 

leisure or professional activity in close proximity with a 
confirmed case, or travelled together with a COVID-19 case 
in any kind of conveyance, without appropriate individual 


In addition to the above, contacts are asked to stay at 
home during a 14-day period after their last contact 
with the confirmed case while symptomatic and to 
avoid contacts with the other persons living in the 
same household (or at least wear a surgical mask). 

The follow-up consists of an active follow-up through 








identified breach. 


protection equipment. Healthcare personnel who treated a 
confirmed case without wearing appropriate PPE or with an 


daily calls from the regional follow-up team organised 
by the Regional Health Agency in collaboration with 
Santé publique France. 











COVID-19: coronavirus disease 2019; PPE: personal protective equipment. 


objective of the surveillance is to identify imported 
cases early and to prevent secondary transmission 
whether in the community or among healthcare work- 
ers (HCW). Investigations are carried out among con- 
tacts immediately upon illness onset and a follow-up 
procedure is initiated according to the evaluated level 
of infection risk. 


Here we describe the real-time implementation of this 
surveillance scheme for the first three imported cases 
of COVID-19 identified in France, who were confirmed 
on 24 January 2020 in persons with a recent stay in 
Wuhan. Two cases were diagnosed in Paris and one 
in Bordeaux. We present data until 12 February on the 
follow-up of the cases’ contacts initiated immediately 
upon confirmation of infection. 


Methods 


French surveillance system 

In France, according to the COVID-19 surveillance pro- 
tocol, physicians suspecting a COVID-19 case have 
to contact immediately either the emergency hotline 
(SAMU-Centre 15), if the patient is seeking medical 
attention from a general practitioner, or a referring 
infectious diseases specialist at hospital level. 
Together, they evaluate whether the patient matches 
the case definition criteria for a possible case (see 
below). If they do, the case has to be reported imme- 
diately through a 24/7 available phone line to the 
Regional Health Agency (Agence régionale de santé, 
ARS), which informs without delay the hospital infec- 
tion control teams involved in the management of the 
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patient, the French Public Health Agency (Santé pub- 
lique France, SpFrance) and the Ministry of Health. 


A standardised investigation form collecting socio- 
demographical information, clinical details and history 
of exposure (history of travel to or residence in Wuhan, 
China or contact with a confirmed case) is completed 
for each possible case at regional level, in collabora- 
tion between the clinicians, the ARS and SpFrance. 
Data are entered into the secure web-based applica- 
tion Voozanoo (Epiconcept, Paris). 


Possible cases have to be hospitalised, isolated and 
cared for in one of the 38 French referral hospitals 
designated by the Ministry of Health, according to the 
guidelines for the management of patients with Middle 
East respiratory syndrome (MERS) [3]. 


For each possible case, respiratory samples from the 
upper respiratory tract (nasopharyngeal swabs or 
aspirates) and when possible from the lower respira- 
tory tract (bronchoalveolar lavage fluid, when indi- 
cated, or induced sputum) are collected and sent to 
one of the laboratories accredited to perform SARS- 
CoV-2-specific real-time RT-PCR. Until 27 January, only 
the National Reference Centre for respiratory viruses 
(Institut Pasteur, Paris) was able to test for the pres- 
ence of the SARS-CoV-2. 


Case definition 

From 17 to 29 January 2020, a possible case was 
defined either as a patient with a severe acute lower 
respiratory infection requiring admission to hospital 
and with a history of travel to or residence in Wuhan, 
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FIGURE 
Timeline of travel, onset of illness and close contacts of confirmed cases of COVID-19, France, January 2020 (n = 3) 
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ED: emergency department; GP: general practitioner; ICU: intensive care unit; ID: infectious diseases. 


China in the 14 days before symptom onset, or a 
patient with an acute respiratory illness whatever the 
severity and with a history of at-risk exposure, mainly 
to a confirmed case. A confirmed case was defined as 
a possible case with a positive SARS-CoV-2 RT-PCR on 
respiratory samples, performed by an accredited labo- 
ratory. Testing relied on the real-time RT-PCR procedure 
developed by the Charité [4] as well as on the use of 
real-time RT-PCR specific for the RdRp gene (four tar- 
gets) designed at Institut Pasteur (RdRp-IP). 


The case definition was first set up on 10 January and 
adapted over time. The detailed case definition used 
for the cases presented here as well as the most up-to- 
date case definition are available in the Supplement. 


Contact and co-exposure tracing 

Co-exposed persons are defined as people who shared 
the same risks of exposure as a possible or confirmed 
case of COVID-19. Contact and co-exposure identifica- 
tion is done for all identified possible cases. Contacts 
are traced from the date of onset of clinical symptoms 
in a case. If the diagnosis of SARS-CoV-2 infection is 
confirmed in the index case, active surveillance of con- 
tacts/co-exposed persons is initiated immediately. 


Three levels of risk of infection are defined for contacts/ 
co-exposed persons of a possible/confirmed COVID-19 
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case (Table). Co-exposed persons of a confirmed case 
are followed-up according to the same procedure as a 
moderate-/high-risk contact. The follow-up procedure 
for the contacts/co-exposed persons differs according 
to the evaluation of the level of risk of infection (Table). 
During the initial implementation phase of the proce- 
dure, owing to the limited number of contacts involved, 
it was decided to also implement an active follow-up 
for low risk contacts. 


Patients are interviewed by the clinicians, with the help 
of a translator if needed, who recover relevant informa- 
tion on their contacts since onset of clinical symptoms 
and the nature and intensity of exposure. The involved 
regional health agencies work closely with the regional 
entities of Santé publique France (cellules régionales) 
in order to implement contact tracing and follow-up. 
Santé publique France coordinates the surveillance 
at national level in liaison with the national Health 
Authorities. 


Ethical statement 

The investigations were carried out in accordance with 
the General Data Protection Regulation (Regulation 
(EU) 2016/679 and Directive 95/46/EC) and the French 
data protection law (Law 78-17 on 06/01/1978 and 
Décret 2019-536 on 29/05/2019). Informed consent to 
disclosure of information relevant to this publication 
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was obtained from the three patients confirmed with 
2019-nCoV infection. 


Results 


Detected confirmed cases 

Between 10 January and 24 January (period until confir- 
mation of the first cases in France), nine possible cases 
were identified in France; among them, three cases 
were confirmed with COVID-19. 


Case 1 was a 48-year-old male patient living in France. 
He was travelling for professional reasons in China in 
various cities including Wuhan when he experienced 
his first symptoms (fever, headaches and cough) on 
16 January. He flew back to Bordeaux, France on 22 
January via Shanghai, Qingdao and Paris Charles de 
Gaulle airports. He reported wearing a mask during 
the flights. He sought medical attention from a general 
practitioner on 23 January, where he was suspected 
of COVID-19, and was subsequently transferred to the 
regional referring hospital in Bordeaux, isolated and 
sampled for laboratory confirmation of SARS-CoV-2 
infection. Infection was confirmed on 24 January by the 
National Reference Centre (Figure). Case 1 tested posi- 
tive only for the E gene target when using the Charité 
procedure [4] and was positive for all four RdRp-IP tar- 
gets with threshold cycles (Ct) in good agreement with 
those obtained for the E gene target. 


The patient arrived in Wuhan on 13 January, did not 
report any visit to markets, exposure to live animals or 
contact with sick persons during his stay. No detailed 
information is available about the circumstances of 
exposure, apart from a visit to family members and 
friends on 15 January. 


Case 2 was a 31-year-old Chinese male tourist who had 
left Wuhan on 18 January and arrived in Paris on 19 
January. He developed fever, chills, fatigue, conjuncti- 
vitis and cough on 19 January. Case 3 was a 30-year- 
old Chinese female tourist who travelled with Case 
2. She developed fever, chills, fatigue and cough on 
23 January. On 24 January, they were advised by the 
Chinese embassy to seek medical attention at the 
national hotline (SAMU-centre 15) and were imme- 
diately transferred to a regional referring hospital, 
isolated and sampled for laboratory confirmation of 
COVID-19. Infection with SARS-CoV-2 was confirmed on 
24 January for both of them by the National Reference 
Centre (Figure). Cases 2 and 3 were positive by RT-PCR 
for all targets of the Charité procedure [4] (RdRp Pan 
Sarbeco and 2019-nCov probes; E; N) as well for the 
four RdRp-IP targets with Ct values in good agreement 
with those obtained for the E gene target. 


The condition of the male patient deteriorated on 29 
January and he was admitted to the intensive care unit 
(ICU) the same day. He stayed 72 h in the ICU for non- 
invasive oxygen therapy and was transferred back to 
infectious diseases ward on 31 January. 
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Neither of the two cases reported any visit to markets, 
exposure to live animals or contact with sick persons 
during the 14 days before symptom onset. Both vis- 
ited a hospital in Wuhan on 16 January for an unrelated 
medical condition in Case 3 (Figure). 


As at 12 February, Case 1 was afebrile and symptomatic 
with a persistent cough. Cases 2 and 3 were not symp- 
tomatic any more and were discharged from hospital 
on 12 February. 


As soon as the infection with SARS-CoV-2 was con- 
firmed for the three cases on 24 January, this infor- 
mation was immediately released through a press 
conference held by the French Minister of Health and 
the Chief Medical Officer. Daily public communication 
on the state of the investigations around the cases was 
subsequently implemented by the Ministry of Health. 
Daily updates were also published on the SpF website. 


The three cases were notified to the European 
Commission via the Early Warning and Response 
System (EWRS) on 26 January, and to the European 
Center for Disease Prevention and Control (ECDC) 
via the European Surveillance System (TESSy) on 28 
January. 


Contact and co-exposition tracing 

No co-exposed person was identified for Case 1. Two 
contacts were evaluated at low risk of infection, the 
taxi driver who drove the case from the airport to his 
home (30-min drive) and the general practitioner who 
took care of the patient before wearing appropriate 
personal protection equipment (3-min non-close con- 
tact). Seventeen contacts were evaluated at moderate/ 
high risk of infection. Four of them shared the same 
waiting room in the general practitioner’s office while 
Case 1 was coughing, seated ca 1-1.5m away from the 
case during 5-30 min. The other 13 contacts were the 
persons sitting in the two seats around Case 1 in the 
Shanghai-Paris and Paris—Bordeaux flights (Figure). 
They were considered at moderate risk of exposure 
despite the fact that Case 1 reported wearing a mask 
during the whole flight; this was based on the length of 
one of the flights (6 h) and the fact that it was unclear 
whether or not Case 1 removed his mask during short 
periods (e.g. meals) and kept the same mask during the 
whole flights. None of the contacts of the Shanghai- 
Paris flight were French nationals and their contact 
tracing was referred to their home countries’ health 
authorities. All other identified contacts were evalu- 
ated at negligible risk of infection because the con- 
tacts were short and/or distant in public settings and 
did not imply face-to-face conversations or because 
appropriate personal protective equipment (PPE) was 
worn by the healthcare personnel who took care of the 
patient, including those involved in the transfer from 
the general practitioner to the referring hospital. 


Cases 2 and 3 stayed together and shared the same 
activities during their stay in Paris, and therefore 
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shared the same contacts from 23 January (date of ill- 
ness onset for Case 3). Three contacts were evaluated 
at low risk of infection: the two owners of the apart- 
ment rented by the couple and a department store 
employee with whom Case 2 reported a distant (1m) 
contact during around 20 min on 22 January. The apart- 
ment owner’s child who visited Cases 2 and 3 and 
was hugged by them was evaluated at moderate/high 
risk of infection (Figure). All other identified contacts 
were evaluated at negligible risk of infection, as con- 
tacts were short and distant in public settings such as 
department stores and did not imply face-to-face con- 
versations or because appropriate PPE was worn by the 
healthcare personnel who took care of the patients. 


Follow-up of the identified contacts was initiated 
according to the COVID-19 procedure (Table). As at 2 
February, two contacts have been classified as pos- 
sible cases since the implementation of the follow-up: 
A person sitting two seats away from Case 1 during 
the Paris—Bordeaux flight, and therefore identified as 
a moderate/high risk contact, developed respiratory 
symptoms on 27 January and was classified as a possi- 
ble case on 31 January and was subsequently excluded 
following negative RT-PCR results. Infection with SARS- 
CoV-2 was excluded on the same day. A radiology assis- 
tant who took care of both Cases 2 and 3 developed 
respiratory symptoms on 30 January and was classified 
as a possible case on 2 February. This person had been 
classified as at negligible risk of exposure, because 
she wore appropriate PPE during the whole procedure. 
Infection with SARS-CoV-2 was excluded on 2 February. 
Follow-up of the contacts ended on 6 February. No 
identified contact of the three cases has been con- 
firmed with COVID-19. 


Discussion 

Specific COVID-19 surveillance has been in place in 
France since 10 January 2020, 3 days after the iden- 
tification of the SARS-CoV-2 in China. The first three 
imported cases of COVID-19 in France, the first ones in 
Europe, were diagnosed 14 days later, on 24 January. 
Rapid and effective collaboration between the cli- 
nicians (general practitioners attending the cases, 
emergency hotline clinicians (SAMU-centre 15) and 
infectious diseases specialists), the National Reference 
Centre and the regional and national health authori- 
ties has played a crucial role in the system’s capacity 
to quickly detect, isolate and investigate those cases 
in order to implement adequate control measures. The 
surveillance system as well as the control measures 
were adapted from those implemented during past 
emerging infections that occurred after 2003 (severe 
acute respiratory syndrome (SARS), MERS, influenza 
A(H1N1)pdmog, Ebolavirus disease), and all involved 
parties were already familiar with the system, which 
probably favoured its responsiveness. 


The case definition of a possible case in use on 24 


January was slightly adapted from the one provided 
by the World Health Organization (WHO), based on 
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an epidemiological link to Wuhan, China and a severe 
lower acute respiratory disease. It is noteworthy that 
the first nine possible cases identified in France, 
including the three confirmed cases described here, 
displayed mild respiratory symptoms with no sign 
of severity at the time of diagnosis. Increasing evi- 
dence suggests that mild clinical symptoms could be 
more frequent in cases of COVID-19 than with SARS- 
CoV and MERS-CoV [5]. Therefore, the case definition 
in effect on 24 January lacked sensitivity. This was 
counter-balanced by a tendency from the infectious 
diseases specialists in charge of classification of sus- 
pected cases to privilege the exposure to Wuhan over 
the clinical presentation in their decision. However, we 
cannot exclude that some COVID-19 cases remained 
undetected in France because of the lack of sensitiv- 
ity of our case definition. The clinical criteria were 
expanded on 4 February to include any lower acute 
respiratory disease and the epidemiological criterion 
was extended to the whole of China. At that time, the 
French laboratory capacities were reinforced from one 
to five laboratories able to perform the diagnostics for 
COVID-19. Further extension to all 38 referring hospital 
laboratories is expected by early to mid-February 2020. 
Santé publique France will deploy in early February the 
outbreak investigation tool developed by the WHO (Go. 
Data [6]) in order to facilitate case data management 
and contact tracing at the national and local level in 
France. 


Contact and co-exposure identification of the three con- 
firmed cases had been initiated as soon as they were 
classified as possible cases, which facilitated investi- 
gations upon confirmation of COVID-19. Confirmation 
of the diagnosis was made in the evening of 24 January 
and the investigation to retrieve as exhaustively as 
possible contacts and co-exposed individuals and 
evaluate their level of risk of transmission was started 
immediately overnight. Complete transparency of the 
investigations was ensured through daily press confer- 
ences held by the French health authorities. 


Although the follow-up procedure for the contacts/co- 
exposed persons used in France slightly differ from 
the ECDC and WHO guidelines [7,8], which were not 
available at the time of this investigation, it relies on 
the same general principles. Contact tracing of the 
passengers seated near Case 1 during the two flights 
Shanghai-Paris and Paris-Bordeaux was adapted 
from the ECDC guidelines for infectious diseases trans- 
mitted on aircraft [9]. Even though Case 1 was wearing 
a face mask during those flights, we could not exclude 
breaches and subsequent risk of transmission to the 
persons sitting in the two seats around him. 


Because of the current uncertainties about the capac- 
ity of SARS-CoV-2 to easily spread from human to 
human, the decision to consider a contact as close if 
the case—contact distance was between 1m and zm 
was made on a case-by-case basis, depending on the 
type and length of interaction. Through the extensive 
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interviews made with the cases and their high com- 
pliance to cooperate to the investigation, we believe 
that the contacts most at risk have been satisfactorily 
identified. All of them could be rapidly contacted and 
informed about measures to be taken, which they all 
agreed to. However, some contacts were either impos- 
sible to trace back (e.g. co-travellers on public trans- 
portation) or evaluated as at negligible risk of exposure 
because of short and/or distant contacts (e.g. restau- 
rant, contacts with cashiers while running errands, vis- 
iting museums), although accidental events carrying 
the risk of transmission on such occasions, such as an 
episode of cough of sneezing, cannot be ruled out. 


Moreover, the contact tracing was limited to the period 
after onset of illness. However, should the transmis- 
sion of SARS-CoV-2 occur during the asymptomatic 
phase, we cannot exclude that secondary transmis- 
sion events initiated from the three confirmed cases 
remained undetected during the investigations. 


Case 3 developed symptoms 4 days after her husband 
and 5 days after the couple had left Wuhan. The incu- 
bation period of SARS-CoV-2 is currently estimated at 
around 3-7 days [5,10,11]. Therefore, she may have 
acquired the infection from her husband, although this 
cannot be proved. 


The active surveillance of close contacts of confirmed 
COVID-19 cases and the implementation of control 
measures, including home quarantine for those evalu- 
ated at moderate/high risk of exposure, decrease the 
risk of human-to-human transmission originating from 
imported cases and subsequently delay propagation 
of the virus in the general population. This allows our 
healthcare system to prepare for any further spread of 
the epidemic. Besides, the epidemiological and clini- 
cal data collected about the confirmed cases and their 
contacts will increase our knowledge of COVID-19. 


The rapid and collaborative management of the first 
imported COVID-19 cases in France highlights the fact 
that the French healthcare system is adequately pre- 
pared to respond to such emerging diseases threats. 
However, this surveillance system is extremely time- 
consuming and requires considerable manpower. The 
data available on 12 February strongly suggest that 
human-to-human transmission of SARS-CoV-2 is fre- 
quent, with the reproduction number estimated at 2 to 
3 [5,10-14]. Twenty-five countries have already reported 
imported cases from China, and several of them have 
described autochthonous transmission events [15]. 
In the case of further spread of SARS-CoV-2 world- 
wide, it would soon become impossible to detect all 
imported cases and trace their contacts. Especially the 
occurrence of large clusters in the same region would 
strongly impact on the local health authorities’ capaci- 
ties. The surveillance objectives would then need to 
evolve from containing the epidemic to mitigating its 
medical and societal impact. 
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As at 12 February, the contacts of the three first con- 
firmed cases of COVID-19 in France have been followed 
up for the whole 14 days follow-up time after the cases 
isolation. No secondary transmission event has been 
detected so far despite active follow-up. Given the first 
estimations of the SARS-CoV-2 incubation period, the 
probability of secondary cases originating from those 
three cases is negligible. 
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Next generation sequencing (NGS) is becoming the 
new gold standard in public health microbiology. Like 
any disruptive technology, its growing popularity 
inevitably attracts cyber security actors, for whom the 
health sector is attractive because it combines mis- 
sion-critical infrastructure and high-value data with 
cybersecurity vulnerabilities. In this Perspective, we 
explore cyber security aspects of microbial NGS. We 
discuss the motivations and objectives for such attack, 
its feasibility and implications, and highlight policy 
considerations aimed at threat mitigation. Particular 
focus is placed on the attack vectors, where the entire 
process of NGS, from sample to result, could be vul- 
nerable, and a risk assessment based on probability 
and impact for representative attack vectors is pre- 
sented. Cyber attacks on microbial NGS could result 
in loss of confidentiality (leakage of personal or insti- 
tutional data), integrity (misdetection of pathogens) 
and availability (denial of sequencing services). NGS 
platforms are also at risk of being used as propagation 
vectors, compromising an entire system or network. 
Owing to the rapid evolution of microbial NGS and its 
applications, and in light of the dynamics of the cyber 
security domain, frequent risk assessments should be 
carried out in order to identify new threats and under- 
pin constantly updated public health policies. 


Introduction 

Next generation sequencing (NGS) is an emerging tech- 
nology in the field of public health microbiology [a]. 
Whole genome sequencing (WGS) of pathogens has 
recently gained acceptance as a new gold standard in 
microbiology for different pathogens and scenarios; it 
allows the unprecedented characterisation of patho- 
gens with respect to taxonomy, antimicrobial resist- 
ance, virulence attributes and genotyping [2]. Among 
many other advantages, it is expected to reduce the 
time from diagnosis to clinical treatment, improve 
surveillance and outbreak investigation and facilitate 
data sharing in public health [3]. The adoption of WGS 
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is rapidly increasing thanks to a dramatic reduction in 
the cost of DNA sequencing [4]. The continuous devel- 
opment in the field of metagenomics suggests that 
NGS could soon be harnessed on a routine basis for 
culture-independent microbiology, which is expected 
to further improve surveillance and management of 
infectious diseases [5]. 


As with any disruptive technology, growing popularity 
of a technology will inevitably attract the interest of 
malicious actors who will try to abuse it, at individual 
or state level. Painfully bright examples of this recur- 
ring pattern involved major disruptions in Internet ser- 
vices worldwide [6] or malicious software specifically 
designed to steal cryptocurrency wallets in the wake of 
Bitcoin’s rise [7]. The collective experience in the field 
of cybersecurity so far suggests that for a new tech- 
nology not to become an immediate hazard, security 
should be integrated as early as possible and periodic 
security audits should be carried out throughout its 
whole lifecycle [8]. The costs of sequencing continue 
to drop, allowing efforts to introduce sequencing glob- 
ally, even into low resource settings. Moreover, small 
footprint benchtop sequencers and, even more impor- 
tantly, portable sequencers are being developed [9]. 
These trends indicate that in the near future, increasing 
proportions of microbial sequence data will be gener- 
ated outside of the traditional laboratory setting, such 
as in the field during investigation, at the bedside and 
even in consumer homes and other unorthodox loca- 
tions (e.g. in outer space [10]). 


In this Perspective, we explore cyber security aspects 
of microbial NGS. We discuss the motivations and 
objectives for a possible attack, its feasibility and 
implications, and highlight policy considerations aimed 
at mitigating this growing threat. 
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FIGURE 
Cyber threat assessment in public health microbiology 
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Schematic representation of a sample-to-result microbiological workflow in the public health microbiology setting. The workflow is divided 
into the pre-analytical, analytical and post-analytical phases of the diagnostic cycle. Red arrows represent vulnerabilities in the different 


phases of the process to different cyber attack vectors. 


Medicine and cyber security 

In recent years, a sharp rise in cyber attacks on smart 
medical equipment had been observed [11] as part 
of the more general trend of increased cyber attacks 
on Internet-connected devices, including smart home 
devices such as locks, cameras, lights and speak- 
ers. Computerised medical equipment is an attrac- 
tive target for malicious cyber activity, as it is among 
a rapidly shrinking group of industries which combine 
mission-critical infrastructure and high-value data (e.g. 
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personal health records), with relatively weak cyberse- 
curity standards [12]. In the context of medical devices, 
cyber threats could be targeting a specific facility or 
organisation, such as the recent incident that involved 
hospitals in the United Kingdom [13], or involve a sup- 
ply chain attack targeting less secure elements in an 
organisational supply network [14]. An adversary might 
carry out a supply chain attack by first compromising a 
network or device-providing service [15]. Cyber security 
must therefore be a core part of a medical product’s 
lifecycle and, in particular, integrated into the product’s 
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TABLE 1 


Cyber threat analysis relevant to next generation sequencing in public health 








Attack vector Methods Target NGS stage Required access 
Physical Malicious biological material Sample preparation Physical 
Hardware Hardware implant Sequencing Interdiction/manufacturing 
Physical 
Sequencing 


Firmware/operating system Firmware replacement 


Interdiction/manufacturing 
Bioinformatics 
Compromised PC 





Targeted infection 
Software 
Supply chain 


Targeted infection 


Compromised PC 
Bioinformatics Local Network 


Remote 


Compromised PC 











Local network Supply chain Bioinformatics 
Remote 
Data breach 
Cloud infrastructure Data breach Bioinformatics Remote 














NGS: next generation sequencing; PC: personal computer. 


design from its inception and not as an afterthought. 
Traditionally, the responsibility for the security of medi- 
cal devices lies with the device manufacturer, while the 
responsibility for sensitive information is in the hands 
of medical institutions. 


The rapid growth of machine learning applications and 
data analytics in medicine are also of great concern 
with respect to cyber security, especially in the face of 
adversarial learning — an advanced offensive technique 
designed to fool models based on machine learning 
that is applicable to medical information technology 
systems [16]. Recent studies in the field of adversar- 
ial learning have demonstrated successful attacks on 
medical devices such as imaging technology [17]. In 
an era of digital transformation of healthcare, cyber 
threats are unavoidable and effective cyber security 
requires a major investment in infrastructure, person- 
nel and governance [12]. 


While cyber attacks on microbial NGS have not been 
reported to date, a practical attack has been per- 
formed compromising a computer as a part of an NGS 
pipeline via a specially synthesised DNA sequence [18], 
which suggests that this avenue deserves more atten- 
tion and that microbial NGS has unique cyber security 
aspects that go beyond generic IT aspects. Of note, the 
malicious sequence was processed by an NGS device 
(an Illumina NextSeq), but the sequencer itself was not 
used as a propagation vector nor was it compromised. 
Rather, it was the NGS device’s proper functionality 
that permitted the attack in the first place. 


Attack vectors 

A schematic representation of the public health micro- 
biological workflow appears in the Figure , involving 
sample preparation, sequencing and bioinformatics 
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analysis stages [19]. The bioinformatics analysis usu- 
ally involves an output or end result, which is inter- 
preted and communicated to relevant stakeholders 
[20]. Table 1 describes the different attack vectors 
and methods applicable to a generic NGS process. An 
adversary can attack at multiple stages of the NGS 
pipeline, with different attacks requiring different 
access levels (e.g. physical, local network, remote net- 
work). This analysis highlights the need for policymak- 
ers to employ cyber security best practices throughout 
the NGS diagnostic cycle, starting from the acquisition 
of biological material and ending in cloud-based bio- 
informatic applications. The analysis shown in Table 
1 is generic — different NGS platforms use a variety of 
technologies and architectures, making some of the 
threats relevant only to a subset of currently available 
platforms. All stages of the NGS process, from sample 
preparation to post-sequencing bioinformatics analy- 
sis, could be vulnerable to cyber attacks. 


Table 2 presents a risk assessment for representative 
attack vectors at the different stages of the NGS pro- 
cess. The probability and impact of each attack are 
ranked on a scale of 1 to 5, each based on the expert 
opinion of the authors. High-probability scores were 
awarded to threats that require minimal access to 
carry out, have higher technological feasibility and for 
which stronger incentives exist among adversaries. 
High-impact scores were awarded to threats resulting 
in overall system compromise and particularly to those 
which made it possible to use the host PC as a cyber 
attack propagation vector and to threats with a wider 
national or international impact. Following the Common 
Vulnerability Scoring System (CVSS) 3.1 methodology 
[21], an overall score for each vector was obtained by 
multiplying its probability and impact scores. The dif- 
ferent threats were then categorised into three groups 
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according to the overall score, with scores ranging from 
1 to 5 being considered minor threats, 6 to 15 repre- 
senting moderately dangerous threats and scores of 16 
to 25 representing major threats. A total of 12 threats 
have been included in the analysis, containing six 
main attack vectors comprising of several adversarial 
methodologies. Of these, three were deemed major, 
six moderate and another three minor threats. Attacks 
pertaining to peripheral or proprietary hardware pre- 
sent the most dangerous combination of required 
access, attack impact and probability and required 
resources, followed by attacks on sequencing soft- 
ware. Table 2 also includes a selection of factors that 
can mitigate the highlighted threats. Some factors, 
such as protecting PCs and cloud servers, are generic 
IT best practices, while some are specific to the NGS 
domain and its use of connected sequencing hardware. 


Attack objectives 

The International Organization for Standardization 
(ISO) standards body defines in ISO/IEC 27000 a Set of 
principles for the operation of a secure system: confi- 
dentiality, integrity and availability [8]. In the specific 
domain of NGS devices, several high-level motivations 
for an adversary can be considered according to these 
principles. 


The confidentiality principle stipulates that a system 
must ensure that information is not made available or 
disclosed to unauthorised entities. In the context of 
NGS, attacks on confidentiality include data leakage 
of medical records, and especially of genetic informa- 
tion, which are considered to be highly personal and 
sensitive and thus of very high value. Data leakage 
may occur through the action of an outside attacker, 
but it may also occur through internal misuse (the 
‘angry administrator’ scenario). Liabilities with respect 
to data safety and security are even more pronounced 
in light of the recent introduction of the general data 
protection regulations (GDPR). In the least harmful sce- 
nario, targeted advertising could take advantage of a 
person’s medical situation, maybe even without their 
awareness, to make profit. In a more concerning sce- 
nario, personal medical records of high-profile targets 
could be used to extort, blackmail or even physically 
harm them. 


Beyond the individual level, leakage of raw sequence 
data or results of sequencing procedures, could result 
in an embarrassment to public health institutions, 
especially if information has not yet been properly 
analysed, or if information is presented out of context 
without relevant metadata and expert interpretation. 


The integrity principle stipulates that a system must 
protect the accuracy and completeness of information. 
In the context of NGS, attacks on integrity include 
misdetection attacks, in which the device could 
appear to be functioning, while in effect, it provides 
false results to the user. Attacking a core sequencing 
facility intended for public health purposes, could 
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lead to erroneous diagnosis and, as a consequence, 
mistreatment of patients or inconclusive investigation. 
Such a scenario would carry grave consequences both 
to individual patients and to medical and public health 
facilities. Significant economical and reputational 
damages should be taken into account in such 
situation. 


Maintaining the integrity of devices is particularly 
important when they are used in an incident response 
scenario. As misdetection could result in a false alarm, 
e.g. an Ebola outbreak could be ‘detected’ while no 
actual virus was present, leading in an extreme case 
scenario to a public health response, disruption of 
routine and critical services, disruption of normal busi- 
ness, public panic and disorder and mobilisation of 
government resources to contain a non-existent out- 
break. In an arguably worse-case scenario, misdetec- 
tion may involve a false-negative result, meaning the 
sequencing procedure would report the sample as 
harmless, while it actually contained a significant bio- 
logical threat. 


The availability principle stipulates that a system 
should be accessible and usable when an authorised 
entity demands access. Denial of service is a form of 
attack in which a device, process, or facility is rendered 
unavailable. In our specific context, sequencing devices 
could be arranged to fail under certain conditions. At 
the very least, such an incident imposes an economic 
penalty on a victim organisation. Furthermore, an 
unexpected failure of devices during a biological inci- 
dent can significantly delay or even deny appropriate 
public health response. 


At the IT infrastructure scale, attackers may attempt 
to compromise a weakly secured device as a stepping 
stone for infiltrating a different network or system. In 
this scenario, the real objective of the attack will not 
be to attack the NGS device itself, but rather to achieve 
system or network compromise. In such an attack, 
the NGS device is used as an infection and propaga- 
tion vector for advancing the attacker’s position to tar- 
get a machine, facility or network associated with the 
device. This attack is common to all connected devices 
and is not unique to NGS devices. NGS devices, how- 
ever, are mainly used in government and medical facili- 
ties, arguably two of the highest-risk sectors regarding 
cyber activity, making this threat important to consider. 
Moreover, the increasing popularity of mobile sequenc- 
ers further augments this vulnerability. 


It is also important to note that while attacks carried 
out on a single device would have a moderate impact 
at best, if deployed at scale, attacks may create a sus- 
tained incident on a national or even global level. 


Attack scenarios 

Here we propose a number of possible attack scenarios 
and discuss the resources and skills required to carry 
them out. 
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Biological substance attack 

As demonstrated by Ney et al. [18], synthesising a mali- 
cious DNA sample to carry out an attack on a sequenc- 
ing PC is technically feasible. That said, extensive 
knowledge of both computer science and microbiology 
is required to carry out such an attack, along with carry- 
ing out extensive security evaluation of the sequencing 
software to find a potential vulnerability. Furthermore, 
the malicious DNA sample should be tailored for the 
specific sequencing device on which the sample would 
end up, a non-trivial piece of foreknowledge. Finally, 
the question of how the sample would end up being 
synthesised by the device in the first place leads to 
scenarios involving field-deployed human agents or 
collaborators on the victim side. Those assumptions 
lead us to rate this threat as having a low probability 
of taking place. Nevertheless, the probability of such 
attack could increase in the future, depending on tech- 
nological advancements. 


Malicious hardware/firmware implant 

In this scenario, attackers manage to be in a position 
where they can communicate with the device locally, 
through serial or networked connections, or can physi- 
cally disassemble it. Recent reports testify to the ability 
and motivation of state actors to place themselves in 
such positions [15,22]. It is not uncommon for workers 
of various sectors to use their company’s PCs for vari- 
ous personal activities, thus increasing the chance of 
infection by malware from the Internet: an NGS device 
compromised at time of manufacturing or by interdic- 
tion could serve as an infection vector for computing 
systems in a medical or government facility, but a PC 
infected ahead of time and controlled by the attack- 
ing party could be used as a remote implanting station 
for the NGS devices in its vicinity. In a typical pub- 
lic health laboratory setting, a small number of NGS 
devices will communicate with numerous PCs as part 
of sequencing and bioinformatics analysis stages, and 
so both directions are efficient propagation vectors. 
Most devices are typically protected from infection by 
IT security safeguards such as malware protection and 
secure coding practices. Medical devices, however, 
are known to be more sensitive to malware and low- 
quality code than other connected devices, owing to 
the lengthy compliance process that makes in-the-field 
upgrades very difficult [12]. Finally, embedded device 
firmware has been shown to suffer often from poor 
security mechanisms and thus is more susceptible to 
various forms of attacks than traditional computer sys- 
tems [23]. The various factors described above lead us 
to believe that this attack scenario is highly probable. 


Next generation sequencing software 
compromise 

Software is known to contain vulnerabilities caused by 
imperfect code, misconfiguration etc., and NGS-related 
software, used to operate sequencing and laboratory 
equipment or carry out the bioinformatics analyses, 
is no exception. Software vulnerabilities are exploited 
to gain unauthorised access to computer systems or 
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networks, leak data, crash or otherwise disrupt various 
services. In the NGS context, vulnerable sequencing 
software could be made to malfunction, report false 
results or serve as an initial foothold on a medical or 
government facility’s network. If the application runs 
with high privileges or makes use of other high-priv- 
ilege software components (e.g. a device driver), this 
scenario could lead to full system takeover. A remotely 
exploitable vulnerability could lead to a remote 
attacker controlling sequencing PCs across the world. 
At scale, this would mean any device which installed 
the sequencing application would serve as an entry 
point to its system and the network it attaches to. 


A different attack vector using the NGS software would 
be a supply chain attack similar to an incident reported 
in 2017 [24], in which the online software repository 
used to distribute a popular application was compro- 
mised, and the hosted application was replaced by a 
malicious version of itself. All instances of the applica- 
tion downloaded from the repository would infect their 
host PCs with malware. A similar incident can occur 
with the repository hosting software powering a bench- 
top or a portable sequencer. According to a recent audit 
of popular sequencing software packages performed 
by Ney et al. [18], those applications generally suffer 
from bad security hygiene practices and thus finding 
an exploit in one of them is highly feasible. 


Policy implications 

The field of microbial genomics is vulnerable to cyber 
threats and therefore, there is a need to develop and 
implement a suitable policy to mitigate such threats. 
The main components of such policy may include the 
following: 


e Cyber security aspects should be taken into account 
when local, national or international surveillance 
systems based on genomics are designed and 
implemented. 


e NGS devices are not simple, passive devices — they 
contain active computing and networking capabili- 
ties and should thus be appropriately considered 
by IT policy. Good general IT and information secu- 
rity organisational practice is important to protect 
against many of the risks described herein. 


e An ongoing dialogue between scientists and prac- 
titioners and IT and security personnel is needed 
in order to identify cyber threats related to newly 
developed and introduced technology. 


e Skills and capacity building in cyber security 
should be considered by public health institutions 
and should be introduced to formal education pro- 
grammes as well as on-the-job training. 


e The possibility of a cyber attack should be taken 
into account during outbreak detection and 
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investigation and explored further by specialists if 
deemed relevant. 


Manufacturers of laboratory equipment, particularly 
DNA sequencing technology, should consider cyber 
security threats during platform development, man- 
ufacturing and marketing. 


Developers of commercial or open source bioin- 
formatics software should consider cyber security 
threats during software development and testing. 


Surveillance tools, capable of detecting or predict- 
ing cyber attacks involving DNA sequencing should 
be developed and implemented in surveillance 
networks. 


The impact and probability of the various attack 
vectors should be evaluated more broadly while 
consulting a range of experts from related fields in 
different countries, in order to fine-tune and validate 
risk assessments. 


Given the rapid evolution of DNA sequencing technol- 
ogy and its applications for microbial genomics and in 
light of the dynamics of the cyber security domain, fre- 
quent risk assessments should be carried out in order 
to identify new threats and update public health policy 
aimed at mitigating those risks. 
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